From 0052fd4a61e107d2ff80780207d2ee8b2c9bb6b3 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 16 Aug 2023 15:55:34 -0500 Subject: [PATCH] adding converted version --- ...indows_powershell_connect_to_internet_with_hidden_window.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 1a36209f4a..7a178c6450 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -35,7 +35,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe") - AND match_regex(process_cmd_line, /(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+h/)=true + AND match_regex(process_cmd_line, /(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+h(i*d*d*e*n*)\\s+/)=true --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be